0

I'm just starting out with reverse engineering, one thing I'm finding difficult is identifying different areas of memory. I'm using radare2, and I would like to be able to easily seek and identify different sections of memory (e.g. data/text/stack/heap etc):

Is there an easy way to do this within radare2?

2

It is possible to list the sections and segments of a program using radare2.

Sections
Use iS to list the program's Sections:

[0x00001c50]> iS
[Sections]
Nm Paddr       Size Vaddr      Memsz Perms Name
00 0x00000000     0 0x00000000     0 ----
01 0x00000238    28 0x00000238    28 -r-- .interp
02 0x00000254    32 0x00000254    32 -r-- .note.ABI_tag
03 0x00000274    36 0x00000274    36 -r-- .note.gnu.build_id
04 0x00000298   100 0x00000298   100 -r-- .gnu.hash
<truncated for readability>
19 0x00007bf0     8 0x00207bf0     8 -rw- .init_array
20 0x00007bf8     8 0x00207bf8     8 -rw- .fini_array
21 0x00007c00    88 0x00207c00    88 -rw- .data.rel.ro
22 0x00007c58   496 0x00207c58   496 -rw- .dynamic
23 0x00007e48   440 0x00207e48   440 -rw- .got
24 0x00008000   128 0x00208000   128 -rw- .data
25 0x00008080     0 0x00208080   416 -rw- .bss
26 0x00008080    52 0x00000000    52 ---- .gnu_debuglink
27 0x000080b4   257 0x00000000   257 ---- .shstrtab

Segements
Use iSS to list its Segments:

[0x00001c50]> iSS
[Segments]
Nm Paddr       Size Vaddr      Memsz Perms Name
00 0x00000040   504 0x00000040   504 -r-x PHDR
01 0x00000238    28 0x00000238    28 -r-- INTERP
02 0x00000000 28120 0x00000000 28120 -r-x LOAD0
03 0x00007bf0  1168 0x00207bf0  1584 -rw- LOAD1
04 0x00007c58   496 0x00207c58   496 -rw- DYNAMIC
05 0x00000254    68 0x00000254    68 -r-- NOTE
06 0x000060a4   580 0x000060a4   580 -r-- GNU_EH_FRAME
07 0x00000000     0 0x00000000     0 -rw- GNU_STACK
08 0x00007bf0  1040 0x00207bf0  1040 -r-- GNU_RELRO
09 0x00000000    64 0x00000000    64 -rw- ehdr

Memory maps
If you want to list different memory maps of a running executable, including the Heap and Stack, this can also be done with radare2. This is relevant only when you are debugging a program (using r2 -d <program>):

[0x7f5e8d50bca6]> dm
0x000055e186c63000 - 0x000055e186c6b000 - usr    32K s r-x /usr/bin/cat /usr/bin/cat ; map.usr_bin_cat.r_x
0x000055e186e6a000 - 0x000055e186e6b000 - usr     4K s r-- /usr/bin/cat /usr/bin/cat ; map.usr_bin_cat.rw
0x000055e186e6b000 - 0x000055e186e6c000 - usr     4K s rw- /usr/bin/cat /usr/bin/cat ; section..data
0x000055e188c8b000 - 0x000055e188cac000 - usr   132K s rw- [heap] [heap]
0x00007f5e8d446000 - 0x00007f5e8d5f9000 * usr   1.7M s r-x /usr/lib/libc-2.27.so /usr/lib/libc-2.27.so
<truncated for readability>
0x00007f5e8da28000 - 0x00007f5e8da29000 - usr     4K s rw- unk2 unk2 ; map.unk0.rw
0x00007ffffa7d7000 - 0x00007ffffa7f8000 - usr   132K s rw- [stack] [stack] ; map.stack_.rw
0x00007ffffa7f9000 - 0x00007ffffa7fc000 - usr    12K s r-- [vvar] [vvar] ; map.vvar_.r
0x00007ffffa7fc000 - 0x00007ffffa7fe000 - usr     8K s r-x [vdso] [vdso] ; map.vdso_.r_x

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.